News for hackers. Stuff that matters.

A comment on What NPM should do to stop a new colors attack. Parent comment

Re:What NPM should do to stop a new colors attack by alex_sf on Monday January 10, 2022 @11:30PM (#29887559)
> People didn't actively go seek out a new version.

When they set their dependency versions to 'latest', that's exactly what they are doing.

[ Parent | on HN ]
Re:What NPM should do to stop a new colors attack by fault1 on Tuesday January 11, 2022 @02:07AM (#29888486)
however, I think the more common case is that they set it to the latest bounded by a minor or patch version (as opposed to a major version) as defined by semvar.

at least that seems to be quite common in the npm/js world.

[ Parent | on HN ]